Commit Graph

1156696 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
2b3ea8bdef This is the 6.1.63 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmVbOmsACgkQONu9yGCS
 aT5m1RAAx7hgbFDnLHCGh4YVBbNy8JngItsUBaJcI/67Mk5toNi0x8pqcS8mq7ED
 GTwRnRcKaIR2bTyco5Ed2OZn4jMCyHC4oiyBZnHWg6AMuQjSCYzIgm7DzlTCVYZ7
 2r8uRbt/uXADTILJ2kwR2mtVpGcwrXa+lsHrMqvt+MvNwRoSVHBHVVYCrAc+JXwR
 GXCopzV/RFGS6w4SBsX0K+8pV7GO+bhpxJ1lPz1T/xeLYfT4C3EwSTWDbUXPbez7
 IpJ+5yKJXXT9Xn9m/pekwZ/aOirLqtEbDxneEctsjvw140lCoQiEZn6ZRscgNEns
 3H+J3Asgc2zXqPzfZFH02TebPj31B8HZ43Upu0okr0hr4A4/4JL9pjXEhm1bON/Z
 x3jlTF4dyay4vOGGIEYOAuJSUbn6AqpZ318uBWCd3BSPocihEDMJz2aoazVHcb6k
 83MVxfFfEL6s9utcoSXB8VjHa4FQmpMYsozegloUSJJCsizgdzmih0buJYhBB9sI
 HbEohW+YAh3cACSn6arXUJIMH5F5xsfD89od2Pj+6UrapdlPz5gCaggA1RZplCho
 bjGc1k61Rp2qSdfMEcx+h4ypgoOdhgqZI0YhYDCgBSRcWOXnGrDjFvnnumatcT+H
 6vqyX6zlNt6U1NpE56Jtf7gt1Ds6PeoadD0L6B8vjXrkdeXOlUU=
 =AZ9s
 -----END PGP SIGNATURE-----

Merge 6.1.63 into android14-6.1-lts

Changes in 6.1.63
	hwmon: (nct6775) Fix incorrect variable reuse in fan_div calculation
	sched/fair: Fix cfs_rq_is_decayed() on !SMP
	iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user()
	sched/uclamp: Set max_spare_cap_cpu even if max_spare_cap is 0
	sched/uclamp: Ignore (util == 0) optimization in feec() when p_util_max = 0
	objtool: Propagate early errors
	sched: Fix stop_one_cpu_nowait() vs hotplug
	vfs: fix readahead(2) on block devices
	writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs
	x86/srso: Fix SBPB enablement for (possible) future fixed HW
	futex: Don't include process MM in futex key on no-MMU
	x86/numa: Introduce numa_fill_memblks()
	ACPI/NUMA: Apply SRAT proximity domain to entire CFMWS window
	x86/sev-es: Allow copy_from_kernel_nofault() in earlier boot
	x86/boot: Fix incorrect startup_gdt_descr.size
	drivers/clocksource/timer-ti-dm: Don't call clk_get_rate() in stop function
	pstore/platform: Add check for kstrdup
	string: Adjust strtomem() logic to allow for smaller sources
	genirq/matrix: Exclude managed interrupts in irq_matrix_allocated()
	wifi: cfg80211: add flush functions for wiphy work
	wifi: mac80211: move radar detect work to wiphy work
	wifi: mac80211: move scan work to wiphy work
	wifi: mac80211: move offchannel works to wiphy work
	wifi: mac80211: move sched-scan stop work to wiphy work
	wifi: mac80211: fix # of MSDU in A-MSDU calculation
	wifi: iwlwifi: honor the enable_ini value
	i40e: fix potential memory leaks in i40e_remove()
	iavf: Fix promiscuous mode configuration flow messages
	selftests/bpf: Correct map_fd to data_fd in tailcalls
	udp: add missing WRITE_ONCE() around up->encap_rcv
	tcp: call tcp_try_undo_recovery when an RTOd TFO SYNACK is ACKed
	gve: Use size_add() in call to struct_size()
	mlxsw: Use size_mul() in call to struct_size()
	tls: Only use data field in crypto completion function
	tls: Use size_add() in call to struct_size()
	tipc: Use size_add() in calls to struct_size()
	net: spider_net: Use size_add() in call to struct_size()
	net: ethernet: mtk_wed: fix EXT_INT_STATUS_RX_FBUF definitions for MT7986 SoC
	wifi: rtw88: debug: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
	wifi: ath11k: fix boot failure with one MSI vector
	wifi: mt76: mt7603: rework/fix rx pse hang check
	wifi: mt76: mt7603: improve watchdog reset reliablity
	wifi: mt76: mt7603: improve stuck beacon handling
	wifi: mt76: mt7915: fix beamforming availability check
	wifi: ath: dfs_pattern_detector: Fix a memory initialization issue
	tcp_metrics: add missing barriers on delete
	tcp_metrics: properly set tp->snd_ssthresh in tcp_init_metrics()
	tcp_metrics: do not create an entry from tcp_init_metrics()
	wifi: rtlwifi: fix EDCA limit set by BT coexistence
	ACPI: property: Allow _DSD buffer data only for byte accessors
	ACPI: video: Add acpi_backlight=vendor quirk for Toshiba Portégé R100
	wifi: ath11k: fix Tx power value during active CAC
	can: dev: can_restart(): don't crash kernel if carrier is OK
	can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on()
	can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds
	PM / devfreq: rockchip-dfi: Make pmu regmap mandatory
	wifi: wfx: fix case where rates are out of order
	netfilter: nf_tables: Drop pointless memset when dumping rules
	thermal: core: prevent potential string overflow
	r8169: use tp_to_dev instead of open code
	r8169: fix rare issue with broken rx after link-down on RTL8125
	selftests: netfilter: test for sctp collision processing in nf_conntrack
	net: skb_find_text: Ignore patterns extending past 'to'
	chtls: fix tp->rcv_tstamp initialization
	tcp: fix cookie_init_timestamp() overflows
	wifi: iwlwifi: call napi_synchronize() before freeing rx/tx queues
	wifi: iwlwifi: pcie: synchronize IRQs before NAPI
	wifi: iwlwifi: empty overflow queue during flush
	Bluetooth: hci_sync: Fix Opcode prints in bt_dev_dbg/err
	bpf: Fix unnecessary -EBUSY from htab_lock_bucket
	ACPI: sysfs: Fix create_pnp_modalias() and create_of_modalias()
	ipv6: avoid atomic fragment on GSO packets
	net: add DEV_STATS_READ() helper
	ipvlan: properly track tx_errors
	regmap: debugfs: Fix a erroneous check after snprintf()
	spi: tegra: Fix missing IRQ check in tegra_slink_probe()
	clk: qcom: gcc-msm8996: Remove RPM bus clocks
	clk: qcom: clk-rcg2: Fix clock rate overflow for high parent frequencies
	clk: qcom: mmcc-msm8998: Don't check halt bit on some branch clks
	clk: qcom: mmcc-msm8998: Fix the SMMU GDSC
	clk: qcom: gcc-sm8150: Fix gcc_sdcc2_apps_clk_src
	regulator: mt6358: Fail probe on unknown chip ID
	clk: imx: Select MXC_CLK for CLK_IMX8QXP
	clk: imx: imx8mq: correct error handling path
	clk: imx: imx8qxp: Fix elcdif_pll clock
	clk: renesas: rcar-gen3: Extend SDnH divider table
	clk: renesas: rzg2l: Wait for status bit of SD mux before continuing
	clk: renesas: rzg2l: Lock around writes to mux register
	clk: renesas: rzg2l: Trust value returned by hardware
	clk: renesas: rzg2l: Use FIELD_GET() for PLL register fields
	clk: renesas: rzg2l: Fix computation formula
	clk: linux/clk-provider.h: fix kernel-doc warnings and typos
	spi: nxp-fspi: use the correct ioremap function
	clk: keystone: pll: fix a couple NULL vs IS_ERR() checks
	clk: ti: change ti_clk_register[_omap_hw]() API
	clk: ti: fix double free in of_ti_divider_clk_setup()
	clk: npcm7xx: Fix incorrect kfree
	clk: mediatek: clk-mt6765: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt6779: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt7629-eth: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt7629: Add check for mtk_alloc_clk_data
	clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
	clk: qcom: config IPQ_APSS_6018 should depend on QCOM_SMEM
	platform/x86: wmi: Fix probe failure when failing to register WMI devices
	platform/x86: wmi: Fix opening of char device
	hwmon: (axi-fan-control) Fix possible NULL pointer dereference
	hwmon: (coretemp) Fix potentially truncated sysfs attribute name
	Revert "hwmon: (sch56xx-common) Add DMI override table"
	Revert "hwmon: (sch56xx-common) Add automatic module loading on supported devices"
	hwmon: (sch5627) Use bit macros when accessing the control register
	hwmon: (sch5627) Disallow write access if virtual registers are locked
	hte: tegra: Fix missing error code in tegra_hte_test_probe()
	drm/rockchip: vop: Fix reset of state in duplicate state crtc funcs
	drm/rockchip: vop: Fix call to crtc reset helper
	drm/rockchip: vop2: Don't crash for invalid duplicate_state
	drm/rockchip: vop2: Add missing call to crtc reset helper
	drm/radeon: possible buffer overflow
	drm: bridge: it66121: Fix invalid connector dereference
	drm/bridge: lt8912b: Add hot plug detection
	drm/bridge: lt8912b: Fix bridge_detach
	drm/bridge: lt8912b: Fix crash on bridge detach
	drm/bridge: lt8912b: Manually disable HPD only if it was enabled
	drm/bridge: lt8912b: Add missing drm_bridge_attach call
	drm/bridge: tc358768: Fix use of uninitialized variable
	drm/bridge: tc358768: Fix bit updates
	drm/bridge: tc358768: remove unused variable
	drm/bridge: tc358768: Use struct videomode
	drm/bridge: tc358768: Print logical values, not raw register values
	drm/bridge: tc358768: Use dev for dbg prints, not priv->dev
	drm/bridge: tc358768: Rename dsibclk to hsbyteclk
	drm/bridge: tc358768: Clean up clock period code
	drm/bridge: tc358768: Fix tc358768_ns_to_cnt()
	drm/amdkfd: fix some race conditions in vram buffer alloc/free of svm code
	drm/amd/display: Check all enabled planes in dm_check_crtc_cursor
	drm/amd/display: Refactor dm_get_plane_scale helper
	drm/amd/display: Bail from dm_check_crtc_cursor if no relevant change
	io_uring/kbuf: Fix check of BID wrapping in provided buffers
	io_uring/kbuf: Allow the full buffer id space for provided buffers
	drm/mediatek: Fix iommu fault by swapping FBs after updating plane state
	drm/mediatek: Fix iommu fault during crtc enabling
	drm/rockchip: cdn-dp: Fix some error handling paths in cdn_dp_probe()
	gpu: host1x: Correct allocated size for contexts
	drm/bridge: lt9611uxc: fix the race in the error path
	arm64/arm: xen: enlighten: Fix KPTI checks
	drm/rockchip: Fix type promotion bug in rockchip_gem_iommu_map()
	xenbus: fix error exit in xenbus_init()
	xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
	drm/msm/dsi: use msm_gem_kernel_put to free TX buffer
	drm/msm/dsi: free TX buffer in unbind
	clocksource/drivers/arm_arch_timer: limit XGene-1 workaround
	drm: mediatek: mtk_dsi: Fix NO_EOT_PACKET settings/handling
	drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process
	perf/arm-cmn: Revamp model detection
	perf/arm-cmn: Fix DTC domain detection
	drivers/perf: hisi_pcie: Check the type first in pmu::event_init()
	perf: hisi: Fix use-after-free when register pmu fails
	ARM: dts: renesas: blanche: Fix typo in GP_11_2 pin name
	arm64: dts: qcom: sdm845: cheza doesn't support LMh node
	arm64: dts: qcom: sc7280: link usb3_phy_wrapper_gcc_usb30_pipe_clk
	arm64: dts: qcom: msm8916: Fix iommu local address range
	arm64: dts: qcom: msm8992-libra: drop duplicated reserved memory
	arm64: dts: qcom: sc7280: Add missing LMH interrupts
	arm64: dts: qcom: sm8150: add ref clock to PCIe PHYs
	arm64: dts: qcom: sm8350: fix pinctrl for UART18
	arm64: dts: qcom: sdm845-mtp: fix WiFi configuration
	ARM64: dts: marvell: cn9310: Use appropriate label for spi1 pins
	arm64: dts: qcom: apq8016-sbc: Add missing ADV7533 regulators
	ARM: dts: qcom: mdm9615: populate vsdcc fixed regulator
	soc: qcom: llcc: Handle a second device without data corruption
	kunit: Fix missed memory release in kunit_free_suite_set()
	firmware: ti_sci: Mark driver as non removable
	arm64: dts: ti: k3-am62a7-sk: Drop i2c-1 to 100Khz
	firmware: arm_ffa: Assign the missing IDR allocation ID to the FFA device
	firmware: arm_ffa: Allow the FF-A drivers to use 32bit mode of messaging
	ARM: dts: am3517-evm: Fix LED3/4 pinmux
	clk: scmi: Free scmi_clk allocated when the clocks with invalid info are skipped
	arm64: dts: imx8qm-ss-img: Fix jpegenc compatible entry
	arm64: dts: imx8mm: Add sound-dai-cells to micfil node
	arm64: dts: imx8mn: Add sound-dai-cells to micfil node
	arm64: tegra: Use correct interrupts for Tegra234 TKE
	selftests/pidfd: Fix ksft print formats
	selftests/resctrl: Ensure the benchmark commands fits to its array
	module/decompress: use vmalloc() for gzip decompression workspace
	ASoC: cs35l41: Verify PM runtime resume errors in IRQ handler
	ASoC: cs35l41: Undo runtime PM changes at driver exit time
	ALSA: hda: cs35l41: Fix unbalanced pm_runtime_get()
	ALSA: hda: cs35l41: Undo runtime PM changes at driver exit time
	KEYS: Include linux/errno.h in linux/verification.h
	crypto: hisilicon/hpre - Fix a erroneous check after snprintf()
	hwrng: bcm2835 - Fix hwrng throughput regression
	hwrng: geode - fix accessing registers
	RDMA/core: Use size_{add,sub,mul}() in calls to struct_size()
	crypto: qat - ignore subsequent state up commands
	crypto: qat - relocate bufferlist logic
	crypto: qat - rename bufferlist functions
	crypto: qat - change bufferlist logic interface
	crypto: qat - generalize crypto request buffers
	crypto: qat - extend buffer list interface
	crypto: qat - fix unregistration of crypto algorithms
	scsi: ibmvfc: Fix erroneous use of rtas_busy_delay with hcall return code
	libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value
	nd_btt: Make BTT lanes preemptible
	crypto: caam/qi2 - fix Chacha20 + Poly1305 self test failure
	crypto: caam/jr - fix Chacha20 + Poly1305 self test failure
	crypto: qat - increase size of buffers
	PCI: vmd: Correct PCI Header Type Register's multi-function check
	hid: cp2112: Fix duplicate workqueue initialization
	crypto: hisilicon/qm - delete redundant null assignment operations
	crypto: hisilicon/qm - modify the process of regs dfx
	crypto: hisilicon/qm - split a debugfs.c from qm
	crypto: hisilicon/qm - fix PF queue parameter issue
	ARM: 9321/1: memset: cast the constant byte to unsigned char
	ext4: move 'ix' sanity check to corrent position
	ASoC: fsl: mpc5200_dma.c: Fix warning of Function parameter or member not described
	IB/mlx5: Fix rdma counter binding for RAW QP
	RDMA/hns: Fix printing level of asynchronous events
	RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common()
	RDMA/hns: Fix signed-unsigned mixed comparisons
	RDMA/hns: Add check for SL
	RDMA/hns: The UD mode can only be configured with DCQCN
	ASoC: SOF: core: Ensure sof_ops_free() is still called when probe never ran.
	ASoC: fsl: Fix PM disable depth imbalance in fsl_easrc_probe
	scsi: ufs: core: Leave space for '\0' in utf8 desc string
	RDMA/hfi1: Workaround truncation compilation error
	HID: cp2112: Make irq_chip immutable
	hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip
	sh: bios: Revive earlyprintk support
	Revert "HID: logitech-hidpp: add a module parameter to keep firmware gestures"
	HID: logitech-hidpp: Remove HIDPP_QUIRK_NO_HIDINPUT quirk
	HID: logitech-hidpp: Don't restart IO, instead defer hid_connect() only
	HID: logitech-hidpp: Revert "Don't restart communication if not necessary"
	HID: logitech-hidpp: Move get_wireless_feature_index() check to hidpp_connect_event()
	ASoC: Intel: Skylake: Fix mem leak when parsing UUIDs fails
	padata: Fix refcnt handling in padata_free_shell()
	crypto: qat - fix deadlock in backlog processing
	ASoC: ams-delta.c: use component after check
	IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
	mfd: core: Un-constify mfd_cell.of_reg
	mfd: core: Ensure disabled devices are skipped without aborting
	mfd: dln2: Fix double put in dln2_probe
	dt-bindings: mfd: mt6397: Add binding for MT6357
	dt-bindings: mfd: mt6397: Split out compatible for MediaTek MT6366 PMIC
	mfd: arizona-spi: Set pdata.hpdet_channel for ACPI enumerated devs
	leds: turris-omnia: Drop unnecessary mutex locking
	leds: turris-omnia: Do not use SMBUS calls
	leds: pwm: Don't disable the PWM when the LED should be off
	leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
	kunit: add macro to allow conditionally exposing static symbols to tests
	apparmor: test: make static symbols visible during kunit testing
	apparmor: fix invalid reference on profile->disconnected
	perf stat: Fix aggr mode initialization
	iio: frequency: adf4350: Use device managed functions and fix power down issue.
	perf kwork: Fix incorrect and missing free atom in work_push_atom()
	perf kwork: Add the supported subcommands to the document
	perf kwork: Set ordered_events to true in 'struct perf_tool'
	filemap: add filemap_get_folios_tag()
	f2fs: convert f2fs_write_cache_pages() to use filemap_get_folios_tag()
	f2fs: compress: fix deadloop in f2fs_write_cache_pages()
	f2fs: compress: fix to avoid use-after-free on dic
	f2fs: compress: fix to avoid redundant compress extension
	tty: tty_jobctrl: fix pid memleak in disassociate_ctty()
	livepatch: Fix missing newline character in klp_resolve_symbols()
	pinctrl: renesas: rzg2l: Make reverse order of enable() for disable()
	perf record: Fix BTF type checks in the off-cpu profiling
	dmaengine: idxd: Register dsa_bus_type before registering idxd sub-drivers
	usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency
	usb: chipidea: Fix DMA overwrite for Tegra
	usb: chipidea: Simplify Tegra DMA alignment code
	dmaengine: ti: edma: handle irq_of_parse_and_map() errors
	misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
	tools: iio: iio_generic_buffer ensure alignment
	USB: usbip: fix stub_dev hub disconnect
	dmaengine: pxa_dma: Remove an erroneous BUG_ON() in pxad_free_desc()
	f2fs: fix to initialize map.m_pblk in f2fs_precache_extents()
	interconnect: qcom: sc7180: Retire DEFINE_QBCM
	interconnect: qcom: sc7180: Set ACV enable_mask
	interconnect: qcom: sc7280: Set ACV enable_mask
	interconnect: qcom: sc8180x: Set ACV enable_mask
	interconnect: qcom: sc8280xp: Set ACV enable_mask
	interconnect: qcom: sdm845: Retire DEFINE_QBCM
	interconnect: qcom: sdm845: Set ACV enable_mask
	interconnect: qcom: sm6350: Retire DEFINE_QBCM
	interconnect: qcom: sm6350: Set ACV enable_mask
	interconnect: move ignore_list out of of_count_icc_providers()
	interconnect: qcom: sm8150: Drop IP0 interconnects
	interconnect: qcom: sm8150: Retire DEFINE_QBCM
	interconnect: qcom: sm8150: Set ACV enable_mask
	interconnect: qcom: sm8350: Retire DEFINE_QBCM
	interconnect: qcom: sm8350: Set ACV enable_mask
	powerpc: Only define __parse_fpscr() when required
	modpost: fix tee MODULE_DEVICE_TABLE built on big-endian host
	modpost: fix ishtp MODULE_DEVICE_TABLE built on big-endian host
	powerpc/40x: Remove stale PTE_ATOMIC_UPDATES macro
	powerpc/xive: Fix endian conversion size
	powerpc/vas: Limit open window failure messages in log bufffer
	powerpc/imc-pmu: Use the correct spinlock initializer.
	powerpc/pseries: fix potential memory leak in init_cpu_associativity()
	xhci: Loosen RPM as default policy to cover for AMD xHC 1.1
	usb: host: xhci-plat: fix possible kernel oops while resuming
	perf machine: Avoid out of bounds LBR memory read
	perf hist: Add missing puts to hist__account_cycles
	9p/net: fix possible memory leak in p9_check_errors()
	i3c: Fix potential refcount leak in i3c_master_register_new_i3c_devs
	cxl/mem: Fix shutdown order
	crypto: ccp - Name -1 return value as SEV_RET_NO_FW_CALL
	x86/sev: Change snp_guest_issue_request()'s fw_err argument
	virt: sevguest: Fix passing a stack buffer as a scatterlist target
	rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
	pcmcia: cs: fix possible hung task and memory leak pccardd()
	pcmcia: ds: fix refcount leak in pcmcia_device_add()
	pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
	media: hantro: Check whether reset op is defined before use
	media: verisilicon: Do not enable G2 postproc downscale if source is narrower than destination
	media: ov5640: Drop dead code using frame_interval
	media: ov5640: fix vblank unchange issue when work at dvp mode
	media: i2c: max9286: Fix some redundant of_node_put() calls
	media: ov5640: Fix a memory leak when ov5640_probe fails
	media: bttv: fix use after free error due to btv->timeout timer
	media: amphion: handle firmware debug message
	media: mtk-jpegenc: Fix bug in JPEG encode quality selection
	media: s3c-camif: Avoid inappropriate kfree()
	media: vidtv: psi: Add check for kstrdup
	media: vidtv: mux: Add check and kfree for kstrdup
	media: cedrus: Fix clock/reset sequence
	media: cadence: csi2rx: Unregister v4l2 async notifier
	media: dvb-usb-v2: af9035: fix missing unlock
	media: cec: meson: always include meson sub-directory in Makefile
	regmap: prevent noinc writes from clobbering cache
	pwm: sti: Reduce number of allocations and drop usage of chip_data
	pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
	Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
	watchdog: ixp4xx: Make sure restart always works
	llc: verify mac len before reading mac header
	hsr: Prevent use after free in prp_create_tagged_frame()
	tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
	bpf: Check map->usercnt after timer->timer is assigned
	inet: shrink struct flowi_common
	octeontx2-pf: Fix error codes
	octeontx2-pf: Fix holes in error code
	net: page_pool: add missing free_percpu when page_pool_init fail
	dccp: Call security_inet_conn_request() after setting IPv4 addresses.
	dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
	net: r8169: Disable multicast filter for RTL8168H and RTL8107E
	Fix termination state for idr_for_each_entry_ul()
	net: stmmac: xgmac: Enable support for multiple Flexible PPS outputs
	selftests: pmtu.sh: fix result checking
	octeontx2-pf: Rename tot_tx_queues to non_qos_queues
	octeontx2-pf: qos send queues management
	octeontx2-pf: Free pending and dropped SQEs
	net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
	net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
	net/smc: put sk reference if close work was canceled
	nvme: fix error-handling for io_uring nvme-passthrough
	tg3: power down device only on SYSTEM_POWER_OFF
	nbd: fix uaf in nbd_open
	blk-core: use pr_warn_ratelimited() in bio_check_ro()
	virtio/vsock: replace virtio_vsock_pkt with sk_buff
	vsock/virtio: remove socket from connected/bound list on shutdown
	r8169: respect userspace disabling IFF_MULTICAST
	i2c: iproc: handle invalid slave state
	netfilter: xt_recent: fix (increase) ipv6 literal buffer length
	netfilter: nft_redir: use `struct nf_nat_range2` throughout and deduplicate eval call-backs
	netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
	RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs
	drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
	ASoC: mediatek: mt8186_mt6366_rt1019_rt5682s: trivial: fix error messages
	ASoC: hdmi-codec: register hpd callback on component probe
	ASoC: dapm: fix clock get name
	spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
	fbdev: imsttfb: Fix error path of imsttfb_probe()
	fbdev: imsttfb: fix a resource leak in probe
	fbdev: fsl-diu-fb: mark wr_reg_wa() static
	tracing/kprobes: Fix the order of argument descriptions
	io_uring/net: ensure socket is marked connected on connect retry
	x86/amd_nb: Use Family 19h Models 60h-7Fh Function 4 IDs
	Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
	btrfs: use u64 for buffer sizes in the tree search ioctls
	wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush()
	virtio/vsock: don't use skbuff state to account credit
	virtio/vsock: remove redundant 'skb_pull()' call
	virtio/vsock: don't drop skbuff on copy failure
	vsock/loopback: use only sk_buff_head.lock to protect the packet queue
	virtio/vsock: fix leaks due to missing skb owner
	virtio/vsock: Fix uninit-value in virtio_transport_recv_pkt()
	virtio/vsock: fix header length on skb merging
	Linux 6.1.63

Change-Id: I87b7a539b11c90cfaf16edb07d613f74d54458a4
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-11-27 16:59:46 +00:00
Greg Kroah-Hartman
0d9fb52165 Merge 6.1.62 into android14-6.1-lts
Changes in 6.1.62
	ASoC: simple-card: fixup asoc_simple_probe() error handling
	coresight: tmc-etr: Disable warnings for allocation failures
	ASoC: tlv320adc3xxx: BUG: Correct micbias setting
	net: sched: cls_u32: Fix allocation size in u32_init()
	irqchip/riscv-intc: Mark all INTC nodes as initialized
	irqchip/stm32-exti: add missing DT IRQ flag translation
	dmaengine: ste_dma40: Fix PM disable depth imbalance in d40_probe
	powerpc/85xx: Fix math emulation exception
	Input: synaptics-rmi4 - handle reset delay when using SMBus trsnsport
	fbdev: atyfb: only use ioremap_uc() on i386 and ia64
	fs/ntfs3: Add ckeck in ni_update_parent()
	fs/ntfs3: Write immediately updated ntfs state
	fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN)
	fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr()
	fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame()
	fs/ntfs3: Fix directory element type detection
	fs/ntfs3: Avoid possible memory leak
	spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0
	netfilter: nfnetlink_log: silence bogus compiler warning
	efi: fix memory leak in krealloc failure handling
	ASoC: rt5650: fix the wrong result of key button
	ASoC: codecs: tas2780: Fix log of failed reset via I2C.
	drm/ttm: Reorder sys manager cleanup step
	fbdev: omapfb: fix some error codes
	fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit()
	scsi: mpt3sas: Fix in error path
	drm/amdgpu: Unset context priority is now invalid
	gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET
	LoongArch: Export symbol invalid_pud_table for modules building
	LoongArch: Replace kmap_atomic() with kmap_local_page() in copy_user_highpage()
	netfilter: nf_tables: audit log object reset once per table
	platform/mellanox: mlxbf-tmfifo: Fix a warning message
	drm/amdgpu: Reserve fences for VM update
	net: chelsio: cxgb4: add an error code check in t4_load_phy_fw
	r8152: Check for unplug in rtl_phy_patch_request()
	r8152: Check for unplug in r8153b_ups_en() / r8153c_ups_en()
	powerpc/mm: Fix boot crash with FLATMEM
	io_uring: kiocb_done() should *not* trust ->ki_pos if ->{read,write}_iter() failed
	ceph_wait_on_conflict_unlink(): grab reference before dropping ->d_lock
	power: supply: core: Use blocking_notifier_call_chain to avoid RCU complaint
	perf evlist: Avoid frequency mode for the dummy event
	x86: KVM: SVM: always update the x2avic msr interception
	mm/mempolicy: fix set_mempolicy_home_node() previous VMA pointer
	mmap: fix error paths with dup_anon_vma()
	ALSA: usb-audio: add quirk flag to enable native DSD for McIntosh devices
	PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD device
	usb: storage: set 1.50 as the lower bcdDevice for older "Super Top" compatibility
	usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
	usb: raw-gadget: properly handle interrupted requests
	tty: n_gsm: fix race condition in status line change on dead connections
	tty: 8250: Remove UC-257 and UC-431
	tty: 8250: Add support for additional Brainboxes UC cards
	tty: 8250: Add support for Brainboxes UP cards
	tty: 8250: Add support for Intashield IS-100
	tty: 8250: Fix port count of PX-257
	tty: 8250: Fix up PX-803/PX-857
	tty: 8250: Add support for additional Brainboxes PX cards
	tty: 8250: Add support for Intashield IX cards
	tty: 8250: Add Brainboxes Oxford Semiconductor-based quirks
	misc: pci_endpoint_test: Add deviceID for J721S2 PCIe EP device support
	ALSA: hda: intel-dsp-config: Fix JSL Chromebook quirk detection
	ASoC: SOF: sof-pci-dev: Fix community key quirk detection
	Linux 6.1.62

Change-Id: I2f696c88b48e82eb0d925a26ce6716693595d421
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-11-27 14:58:20 +00:00
Greg Kroah-Hartman
d3f3412122 Merge branch 'android14-6.1' into branch 'android14-6.1-lts'
This syncs up the android14-6.1-lts branch with many changes that have
happened in the android14-6.1 branch.

Included in here are the following commits:

d2c0f4c450 FROMLIST: devcoredump: Send uevent once devcd is ready
95307ec5c8 FROMLIST: iommu: Avoid more races around device probe
5c8e593916 ANDROID: Update the ABI symbol list
94ddfc9ce4 FROMLIST: ufs: core: clear cmd if abort success in mcq mode
8f46c34931 BACKPORT: wifi: cfg80211: Allow AP/P2PGO to indicate port authorization to peer STA/P2PClient
b3ccd8f092 BACKPORT: wifi: cfg80211: OWE DH IE handling offload
daa7a3d95d ANDROID: KVM: arm64: mount procfs for pKVM module loading
1b639e97b8 ANDROID: GKI: Update symbol list for mtk
b496cc3115 ANDROID: fuse-bpf: Add NULL pointer check in fuse_release_in
8431e524d6 UPSTREAM: serial: 8250_port: Check IRQ data before use
825c17428a ANDROID: KVM: arm64: Fix error path in pkvm_mem_abort()
22e9166465 ANDROID: abi_gki_aarch64_qcom: Update symbol list
ca06bb1e93 ANDROID: GKI: add allowed list for Exynosauto SoC
fb91717581 ANDROID: Update the ABI symbol list
ec3c9a1702 ANDROID: sched: Add vendor hook for util_fits_cpu
c47043d65f ANDROID: update symbol for unisoc vendor_hooks
6e881bf034 ANDROID: vendor_hooks: mm: add hook to count the number pages allocated for each slab
a59b32866c UPSTREAM: usb: gadget: udc: Handle gadget_connect failure during bind operation
7a33209b36 ANDROID: Update the ABI symbol list
69b689971a ANDROID: softirq: Add EXPORT_SYMBOL_GPL for softirq and tasklet
48c6c901fe ANDROID: fs/passthrough: Fix compatibility with R/O file system
abcd4c51e7 FROMLIST: usb: typec: tcpm: Fix sink caps op current check
9d6ac9dc6a UPSTREAM: scsi: ufs: core: Add advanced RPMB support where UFSHCI 4.0 does not support EHS length in UTRD
beea09533d ANDROID: ABI: Update symbol list for MediatTek
5683c2b460 ANDROID: vendor_hooks: Add hook for mmc queue
43a07d84da Revert "proc: allow pid_revalidate() during LOOKUP_RCU"
230d34da33 UPSTREAM: scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5
0920d4de75 ANDROID: GKI: Update symbols to symbol list
019393a917 ANDROID: vendor_hook: Add hook to tune readaround size
0c859c2180 ANDROID: add for tuning readahead size
a8206e3023 ANDROID: vendor_hooks: Add hooks to avoid key threads stalled in memory allocations
ad9947dc8d ANDROID: GKI: Update oplus symbol list
71f3b61ee4 ANDROID: vendor_hooks: add hooks for adjust kvmalloc_node alloc_flags
fef66e8544 UPSTREAM: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
7bec8a8180 ANDROID: ABI: Update symbol list for imx
af888bd2a1 ANDROID: abi_gki_aarch64_qcom: Add __netif_rx
131de563f6 ANDROID: ABI: Update sony symbol list and stg
977770ec27 ANDROID: mmc: Add vendor hooks for sdcard failure diagnostics
f8d3b450e9 ANDROID: Update symbol list for mtk
2799026a28 UPSTREAM: scsi: ufs: mcq: Fix the search/wrap around logic
7350783e67 UPSTREAM: scsi: ufs: core: Fix ufshcd_inc_sq_tail() function bug
ff5fa0b7bd FROMLIST: ufs: core: Expand MCQ queue slot to DeviceQueueDepth + 1
4bbeaddf9a Revert "ANDROID: KVM: arm64: Don't allocate from handle_host_mem_abort"
9d38c0bc65 BACKPORT: usb: typec: altmodes/displayport: Signal hpd when configuring pin assignment
e329419f70 UPSTREAM: mm: multi-gen LRU: don't spin during memcg release
3d1b582966 UPSTREAM: vringh: don't use vringh_kiov_advance() in vringh_iov_xfer()

Change-Id: I89958775659103a11ae82cac8d6b4764251da3c5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-11-27 14:53:17 +00:00
Mukesh Ojha
d2c0f4c450 FROMLIST: devcoredump: Send uevent once devcd is ready
dev_coredumpm() creates a devcoredump device and adds it
to the core kernel framework which eventually end up
sending uevent to the user space and later creates a
symbolic link to the failed device. An application
running in userspace may be interested in this symbolic
link to get the name of the failed device.

In a issue scenario, once uevent sent to the user space
it start reading '/sys/class/devcoredump/devcdX/failing_device'
to get the actual name of the device which might not been
created and it is in its path of creation.

To fix this, suppress sending uevent till the failing device
symbolic link gets created and send uevent once symbolic
link is created successfully.

Bug: 311580372
Link: https://lore.kernel.org/lkml/1700232572-25823-1-git-send-email-quic_mojha@quicinc.com
Change-Id: Iee739e29492056df9d664ef2294a7e0cdcc4458e
Fixes: 833c95456a ("device coredump: add new device coredump class")
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Cc: stable@vger.kernel.org
Signed-off-by: Naman Jain <quic_namajain@quicinc.com>
2023-11-24 19:28:43 +00:00
Robin Murphy
95307ec5c8 FROMLIST: iommu: Avoid more races around device probe
It turns out there are more subtle races beyond just the main part of
__iommu_probe_device() itself running in parallel - the dev_iommu_free()
on the way out of an unsuccessful probe can still manage to trip up
concurrent accesses to a device's fwspec. Thus, extend the scope of
iommu_probe_device_lock() to also serialise fwspec creation and initial
retrieval.

Reported-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
Link: https://lore.kernel.org/linux-iommu/e2e20e1c-6450-4ac5-9804-b0000acdf7de@quicinc.com/
Fixes: 01657bc14a39 ("iommu: Avoid races around device probe")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Bug: 308940593
Link: https://lore.kernel.org/all/16f433658661d7cadfea51e7c65da95826112a2b.1700071477.git.robin.murphy@arm.com/
Change-Id: I461df05b03644cb93bc93599cb9f5464bf893923
Signed-off-by: André Draszik <draszik@google.com>
2023-11-23 09:00:10 +00:00
Claire Chang
5c8e593916 ANDROID: Update the ABI symbol list
Adding the following symbols:
  - anon_inode_getfile

Bug: 312619042
Change-Id: I48be67c5fcaf441ad74793ab7e02b39ca284d528
Signed-off-by: Claire Chang <tientzu@google.com>
2023-11-22 13:53:07 +08:00
Peter Wang
94ddfc9ce4 FROMLIST: ufs: core: clear cmd if abort success in mcq mode
In mcq mode, if cmd is pending in device and abort success, response
will not return from device. So we need clear this cmd right now,
else command timeout happen and next time use same tag will have
warning. WARN_ON(lrbp->cmd).

Below is error log:
<3>[ 2277.447611][T21376] ufshcd-mtk 112b0000.ufshci: ufshcd_try_to_abort_task: cmd pending in the device. tag = 7
<3>[ 2277.476954][T21376] ufshcd-mtk 112b0000.ufshci: Aborting tag 7 / CDB 0x2a succeeded
<6>[ 2307.551263][T30974] ufshcd-mtk 112b0000.ufshci: ufshcd_abort: Device abort task at tag 7
<4>[ 2307.623264][  T327] WARNING: CPU: 5 PID: 327 at source/drivers/ufs/core/ufshcd.c:3021 ufshcd_queuecommand+0x66c/0xe34

Bug: 311330965
Link: https://lore.kernel.org/all/20231115131024.15829-1-peter.wang@mediatek.com/
[Peter: Resolved minor conflict in drivers/ufs/core/ufshcd.c ]
Change-Id: I8e5ed6774a68faa4a663cc602dac56faf5e3317c
Signed-off-by: Peter Wang <peter.wang@mediatek.com>
2023-11-21 22:04:42 +00:00
Vinayak Yadawad
8f46c34931 BACKPORT: wifi: cfg80211: Allow AP/P2PGO to indicate port authorization to peer STA/P2PClient
In 4way handshake offload, cfg80211_port_authorized enables driver
to indicate successful 4way handshake to cfg80211 layer. Currently
this path of port authorization is restricted to interface type
NL80211_IFTYPE_STATION and NL80211_IFTYPE_P2P_CLIENT. This patch
extends the support for NL80211_IFTYPE_AP and NL80211_IFTYPE_P2P_GO
interfaces to authorize peer STA/P2P_CLIENT, whenever authentication
is offloaded on the AP/P2P_GO interface.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
Link: https://lore.kernel.org/r/dee3b0a2b4f617e932c90bff4504a89389273632.1695721435.git.vinayak.yadawad@broadcom.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 301410304
(cherry picked from commit e4e7e3af73694380f0d9a742d13b80598a3393e9)
[chenpaul: adjust the format by checkpatch]
Signed-off-by: Paul Chen <chenpaul@google.com>
Change-Id: Id9704d7b412396f45e888895e42ba161ecb0ab56
2023-11-20 22:25:18 +00:00
Vinayak Yadawad
b3ccd8f092 BACKPORT: wifi: cfg80211: OWE DH IE handling offload
Introduce new feature flags for OWE offload that driver can
advertise to indicate kernel/application space to avoid DH IE
handling. When this flag is advertised, the driver/device will
take care of DH IE inclusion and processing of peer DH IE to
generate PMK.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
Link: https://lore.kernel.org/r/f891cce4b52c939dfc6b71bb2f73e560e8cad287.1695374530.git.vinayak.yadawad@broadcom.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

Bug: 301410304
(cherry picked from commit 5482c0a28b2634e7a7d8ddaca7feac183e74b528)
[chenpaul: use reserved fields instead of adding new one]
Signed-off-by: Paul Chen <chenpaul@google.com>
Change-Id: I8322e53b74d995471411967aba846a2b712e5d85
2023-11-20 22:25:18 +00:00
Greg Kroah-Hartman
69e434a1cb Linux 6.1.63
Link: https://lore.kernel.org/r/20231115192645.143643130@linuxfoundation.org
Tested-by: SeongJae Park <sj@kernel.org>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Ron Economos <re@w6rz.net>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Allen Pais <apais@linux.microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:19 +01:00
Arseniy Krasnov
830c11c9c0 virtio/vsock: fix header length on skb merging
commit f7154d967bc4ee25ea1572937550e711b2525474 upstream.

This fixes appending newly arrived skbuff to the last skbuff of the
socket's queue. Problem fires when we are trying to append data to skbuff
which was already processed in dequeue callback at least once. Dequeue
callback calls function 'skb_pull()' which changes 'skb->len'. In current
implementation 'skb->len' is used to update length in header of the last
skbuff after new data was copied to it. This is bug, because value in
header is used to calculate 'rx_bytes'/'fwd_cnt' and thus must be not
be changed during skbuff's lifetime.

Bug starts to fire since:

commit 077706165717
("virtio/vsock: don't use skbuff state to account credit")

It presents before, but didn't triggered due to a little bit buggy
implementation of credit calculation logic. So use Fixes tag for it.

Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit")
Signed-off-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:19 +01:00
Shigeru Yoshida
cd12535b97 virtio/vsock: Fix uninit-value in virtio_transport_recv_pkt()
commit 34c4effacfc329aeca5635a69fd9e0f6c90b4101 upstream.

KMSAN reported the following uninit-value access issue:

=====================================================
BUG: KMSAN: uninit-value in virtio_transport_recv_pkt+0x1dfb/0x26a0 net/vmw_vsock/virtio_transport_common.c:1421
 virtio_transport_recv_pkt+0x1dfb/0x26a0 net/vmw_vsock/virtio_transport_common.c:1421
 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120
 process_one_work kernel/workqueue.c:2630 [inline]
 process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703
 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784
 kthread+0x3cc/0x520 kernel/kthread.c:388
 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

Uninit was stored to memory at:
 virtio_transport_space_update net/vmw_vsock/virtio_transport_common.c:1274 [inline]
 virtio_transport_recv_pkt+0x1ee8/0x26a0 net/vmw_vsock/virtio_transport_common.c:1415
 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120
 process_one_work kernel/workqueue.c:2630 [inline]
 process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703
 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784
 kthread+0x3cc/0x520 kernel/kthread.c:388
 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

Uninit was created at:
 slab_post_alloc_hook+0x105/0xad0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3478 [inline]
 kmem_cache_alloc_node+0x5a2/0xaf0 mm/slub.c:3523
 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:559
 __alloc_skb+0x2fd/0x770 net/core/skbuff.c:650
 alloc_skb include/linux/skbuff.h:1286 [inline]
 virtio_vsock_alloc_skb include/linux/virtio_vsock.h:66 [inline]
 virtio_transport_alloc_skb+0x90/0x11e0 net/vmw_vsock/virtio_transport_common.c:58
 virtio_transport_reset_no_sock net/vmw_vsock/virtio_transport_common.c:957 [inline]
 virtio_transport_recv_pkt+0x1279/0x26a0 net/vmw_vsock/virtio_transport_common.c:1387
 vsock_loopback_work+0x3bb/0x5a0 net/vmw_vsock/vsock_loopback.c:120
 process_one_work kernel/workqueue.c:2630 [inline]
 process_scheduled_works+0xff6/0x1e60 kernel/workqueue.c:2703
 worker_thread+0xeca/0x14d0 kernel/workqueue.c:2784
 kthread+0x3cc/0x520 kernel/kthread.c:388
 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

CPU: 1 PID: 10664 Comm: kworker/1:5 Not tainted 6.6.0-rc3-00146-g9f3ebbef746f #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014
Workqueue: vsock-loopback vsock_loopback_work
=====================================================

The following simple reproducer can cause the issue described above:

int main(void)
{
  int sock;
  struct sockaddr_vm addr = {
    .svm_family = AF_VSOCK,
    .svm_cid = VMADDR_CID_ANY,
    .svm_port = 1234,
  };

  sock = socket(AF_VSOCK, SOCK_STREAM, 0);
  connect(sock, (struct sockaddr *)&addr, sizeof(addr));
  return 0;
}

This issue occurs because the `buf_alloc` and `fwd_cnt` fields of the
`struct virtio_vsock_hdr` are not initialized when a new skb is allocated
in `virtio_transport_init_hdr()`. This patch resolves the issue by
initializing these fields during allocation.

Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
Reported-and-tested-by: syzbot+0c8ce1da0ac31abbadcd@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0c8ce1da0ac31abbadcd
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20231104150531.257952-1-syoshida@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:19 +01:00
Bobby Eshleman
a6650e78c4 virtio/vsock: fix leaks due to missing skb owner
commit f9d2b1e146e0f82f3d04629afd92698522058361 upstream.

This patch sets the skb owner in the recv and send path for virtio.

For the send path, this solves the leak caused when
virtio_transport_purge_skbs() finds skb->sk is always NULL and therefore
never matches it with the current socket. Setting the owner upon
allocation fixes this.

For the recv path, this ensures correctness of accounting and also
correct transfer of ownership in vsock_loopback (when skbs are sent from
one socket and received by another).

Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
Signed-off-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
Link: https://lore.kernel.org/all/ZCCbATwov4U+GBUv@pop-os.localdomain/
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:19 +01:00
Stefano Garzarella
bb1c9a5907 vsock/loopback: use only sk_buff_head.lock to protect the packet queue
commit b465518dc27da1ed74b8cbada4659708aac35adb upstream.

pkt_list_lock was used before commit 71dc9ec9ac7d ("virtio/vsock:
replace virtio_vsock_pkt with sk_buff") to protect the packet queue.
After that commit we switched to sk_buff and we are using
sk_buff_head.lock in almost every place to protect the packet queue
except in vsock_loopback_work() when we call skb_queue_splice_init().

As reported by syzbot, this caused unlocked concurrent access to the
packet queue between vsock_loopback_work() and
vsock_loopback_cancel_pkt() since it is not holding pkt_list_lock.

With the introduction of sk_buff_head, pkt_list_lock is redundant and
can cause confusion, so let's remove it and use sk_buff_head.lock
everywhere to protect the packet queue access.

Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
Cc: bobby.eshleman@bytedance.com
Reported-and-tested-by: syzbot+befff0a9536049e7902e@syzkaller.appspotmail.com
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
Reviewed-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:19 +01:00
Arseniy Krasnov
1e5f00e9db virtio/vsock: don't drop skbuff on copy failure
commit 8daaf39f7f6ef53a11817f6a11ec104016c3545f upstream.

This returns behaviour of SOCK_STREAM read as before skbuff usage. When
copying to user fails current skbuff won't be dropped, but returned to
sockets's queue. Technically instead of 'skb_dequeue()', 'skb_peek()' is
called and when skbuff becomes empty, it is removed from queue by
'__skb_unlink()'.

Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
Signed-off-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:19 +01:00
Arseniy Krasnov
883a3db221 virtio/vsock: remove redundant 'skb_pull()' call
commit 6825e6b4f8e53799d83bc39ca6ec5baed4e2adde upstream.

Since we now no longer use 'skb->len' to update credit, there is no sense
to update skbuff state, because it is used only once after dequeue to
copy data and then will be released.

Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
Signed-off-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:19 +01:00
Arseniy Krasnov
5852a2b573 virtio/vsock: don't use skbuff state to account credit
commit 077706165717686a2a6a71405fef036cd5b37ae0 upstream.

'skb->len' can vary when we partially read the data, this complicates the
calculation of credit to be updated in 'virtio_transport_inc_rx_pkt()/
virtio_transport_dec_rx_pkt()'.

Also in 'virtio_transport_dec_rx_pkt()' we were miscalculating the
credit since 'skb->len' was redundant.

For these reasons, let's replace the use of skbuff state to calculate new
'rx_bytes'/'fwd_cnt' values with explicit value as input argument. This
makes code more simple, because it is not needed to change skbuff state
before each call to update 'rx_bytes'/'fwd_cnt'.

Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
Signed-off-by: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:19 +01:00
Johannes Berg
25bc87768c wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush()
commit 8c73d5248dcf112611654bcd32352dc330b02397 upstream.

Clearly, there's no space in the function name, not sure how
that could've happened. Put the underscore that it should be.

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Fixes: 56cfb8ce1f7f ("wifi: cfg80211: add flush functions for wiphy work")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:18 +01:00
Filipe Manana
fc3a19543e btrfs: use u64 for buffer sizes in the tree search ioctls
[ Upstream commit dec96fc2dcb59723e041416b8dc53e011b4bfc2e ]

In the tree search v2 ioctl we use the type size_t, which is an unsigned
long, to track the buffer size in the local variable 'buf_size'. An
unsigned long is 32 bits wide on a 32 bits architecture. The buffer size
defined in struct btrfs_ioctl_search_args_v2 is a u64, so when we later
try to copy the local variable 'buf_size' to the argument struct, when
the search returns -EOVERFLOW, we copy only 32 bits which will be a
problem on big endian systems.

Fix this by using a u64 type for the buffer sizes, not only at
btrfs_ioctl_tree_search_v2(), but also everywhere down the call chain
so that we can use the u64 at btrfs_ioctl_tree_search_v2().

Fixes: cc68a8a5a4 ("btrfs: new ioctl TREE_SEARCH_V2")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/linux-btrfs/ce6f4bd6-9453-4ffe-ba00-cee35495e10f@moroto.mountain/
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Dominique Martinet
c606c43ab6 Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
commit 421b605edb1ce611dee06cf6fd9a1c1f2fd85ad0 upstream.

This reverts commit 84ee19bffc9306128cd0f1c650e89767079efeff.

The commit above made quirks with an OEMID fail to be applied, as they
were checking card->cid.oemid for the full 16 bits defined in MMC_FIXUP
macros but the field would only contain the bottom 8 bits.

eMMC v5.1A might have bogus values in OEMID's higher bits so another fix
will be made, but it has been decided to revert this until that is ready.

Fixes: 84ee19bffc93 ("mmc: core: Capture correct oemid-bits for eMMC cards")
Link: https://lkml.kernel.org/r/ZToJsSLHr8RnuTHz@codewreck.org
Link: https://lkml.kernel.org/r/CAPDyKFqkKibcXnwjnhc3+W1iJBHLeqQ9BpcZrSwhW2u9K2oUtg@mail.gmail.com
Signed-off-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
Cc: stable@vger.kernel.org
Cc: Alex Fetters <Alex.Fetters@garmin.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Link: https://lore.kernel.org/r/20231103004220.1666641-1-asmadeus@codewreck.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:18 +01:00
Yazen Ghannam
acca43d813 x86/amd_nb: Use Family 19h Models 60h-7Fh Function 4 IDs
commit 2a565258b3f4bbdc7a3c09cd02082cb286a7bffc upstream.

Three PCI IDs for DF Function 4 were defined but not used.

Add them to the "link" list.

Fixes: f8faf34966 ("x86/amd_nb: Add AMD PCI IDs for SMN communication")
Fixes: 23a5b8bb022c ("x86/amd_nb: Add PCI ID for family 19h model 78h")
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230803150430.3542854-1-yazen.ghannam@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:18 +01:00
Jens Axboe
129debbb41 io_uring/net: ensure socket is marked connected on connect retry
commit f8f9ab2d98116e79d220f1d089df7464ad4e026d upstream.

io_uring does non-blocking connection attempts, which can yield some
unexpected results if a connect request is re-attempted by an an
application. This is equivalent to the following sync syscall sequence:

sock = socket(AF_INET, SOCK_STREAM | SOCK_NONBLOCK, IPPROTO_TCP);
connect(sock, &addr, sizeof(addr);

ret == -1 and errno == EINPROGRESS expected here. Now poll for POLLOUT
on sock, and when that returns, we expect the socket to be connected.
But if we follow that procedure with:

connect(sock, &addr, sizeof(addr));

you'd expect ret == -1 and errno == EISCONN here, but you actually get
ret == 0. If we attempt the connection one more time, then we get EISCON
as expected.

io_uring used to do this, but turns out that bluetooth fails with EBADFD
if you attempt to re-connect. Also looks like EISCONN _could_ occur with
this sequence.

Retain the ->in_progress logic, but work-around a potential EISCONN or
EBADFD error and only in those cases look at the sock_error(). This
should work in general and avoid the odd sequence of a repeated connect
request returning success when the socket is already connected.

This is all a side effect of the socket state being in a CONNECTING
state when we get EINPROGRESS, and only a re-connect or other related
operation will turn that into CONNECTED.

Cc: stable@vger.kernel.org
Fixes: 3fb1bd6881 ("io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT")
Link: https://github.com/axboe/liburing/issues/980
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-20 11:52:18 +01:00
Yujie Liu
b80b85f494 tracing/kprobes: Fix the order of argument descriptions
[ Upstream commit f032c53bea6d2057c14553832d846be2f151cfb2 ]

The order of descriptions should be consistent with the argument list of
the function, so "kretprobe" should be the second one.

int __kprobe_event_gen_cmd_start(struct dynevent_cmd *cmd, bool kretprobe,
                                 const char *name, const char *loc, ...)

Link: https://lore.kernel.org/all/20231031041305.3363712-1-yujie.liu@intel.com/

Fixes: 2a588dd1d5 ("tracing: Add kprobe event command generation functions")
Suggested-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Yujie Liu <yujie.liu@intel.com>
Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Arnd Bergmann
28e7153418 fbdev: fsl-diu-fb: mark wr_reg_wa() static
[ Upstream commit a5035c81847430dfa3482807b07325f29e9e8c09 ]

wr_reg_wa() is not an appropriate name for a global function, and doesn't need
to be global anyway, so mark it static and avoid the warning:

drivers/video/fbdev/fsl-diu-fb.c:493:6: error: no previous prototype for 'wr_reg_wa' [-Werror=missing-prototypes]

Fixes: 0d9dab39fb ("powerpc/5121: fsl-diu-fb: fix issue with re-enabling DIU area descriptor")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Dan Carpenter
7bc7b82fb2 fbdev: imsttfb: fix a resource leak in probe
[ Upstream commit aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b ]

I've re-written the error handling but the bug is that if init_imstt()
fails we need to call iounmap(par->cmap_regs).

Fixes: c75f5a550610 ("fbdev: imsttfb: Fix use after free bug in imsttfb_probe")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Helge Deller
9858458282 fbdev: imsttfb: Fix error path of imsttfb_probe()
[ Upstream commit 518ecb6a209f6ff678aeadf9f2bf870c0982ca85 ]

Release ressources when init_imstt() returns failure.

Signed-off-by: Helge Deller <deller@gmx.de>
Stable-dep-of: aba6ab57a910 ("fbdev: imsttfb: fix a resource leak in probe")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Amit Kumar Mahapatra
6d53668c43 spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
[ Upstream commit c2ded280a4b1b7bd93e53670528504be08d24967 ]

Zynq QSPI driver has been converted to use spi-mem framework so
add spi-mem to driver kconfig dependencies.

Fixes: 67dca5e580 ("spi: spi-mem: Add support for Zynq QSPI controller")
Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/1699037031-702858-1-git-send-email-radhey.shyam.pandey@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Jerome Brunet
b4843bf39d ASoC: dapm: fix clock get name
[ Upstream commit 4bdcbc31ad2112385ad525b28972c45015e6ad70 ]

The name currently used to get the clock includes the dapm prefix.
It should use the name as provided to the widget, without the prefix.

Fixes: 3caac75968 ("ASoC: soc-dapm.c: fixup snd_soc_dapm_new_control_unlocked() error handling")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20231106103712.703962-1-jbrunet@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Jerome Brunet
f5350c6f78 ASoC: hdmi-codec: register hpd callback on component probe
[ Upstream commit 15be353d55f9e12e34f9a819f51eb41fdef5eda8 ]

The HDMI hotplug callback to the hdmi-codec is currently registered when
jack is set.

The hotplug not only serves to report the ASoC jack state but also to get
the ELD. It should be registered when the component probes instead, so it
does not depend on the card driver registering a jack for the HDMI to
properly report the ELD.

Fixes: 25ce4f2b35 ("ASoC: hdmi-codec: Get ELD in before reporting plugged event")
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://lore.kernel.org/r/20231106104013.704356-1-jbrunet@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Eugen Hristev
acc36089bc ASoC: mediatek: mt8186_mt6366_rt1019_rt5682s: trivial: fix error messages
[ Upstream commit 004fc58edea6f00db9ad07b40b882e8d976f7a54 ]

Property 'playback-codecs' is referenced as 'speaker-codec' in the error
message, and this can lead to confusion.
Correct the error message such that the correct property name is
referenced.

Fixes: 0da16e370d ("ASoC: mediatek: mt8186: add machine driver with mt6366, rt1019 and rt5682s")
Signed-off-by: Eugen Hristev <eugen.hristev@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20231031103139.77395-1-eugen.hristev@collabora.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:18 +01:00
Erik Kurzinger
3bbf06efb8 drm/syncobj: fix DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE
[ Upstream commit 101c9f637efa1655f55876644d4439e552267527 ]

If DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT is invoked with the
DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE flag set but no fence has yet been
submitted for the given timeline point the call will fail immediately
with EINVAL. This does not match the intended behavior where the call
should wait until the fence has been submitted (or the timeout expires).

The following small example program illustrates the issue. It should
wait for 5 seconds and then print ETIME, but instead it terminates right
away after printing EINVAL.

  #include <stdio.h>
  #include <fcntl.h>
  #include <time.h>
  #include <errno.h>
  #include <xf86drm.h>
  int main(void)
  {
      int fd = open("/dev/dri/card0", O_RDWR);
      uint32_t syncobj;
      drmSyncobjCreate(fd, 0, &syncobj);
      struct timespec ts;
      clock_gettime(CLOCK_MONOTONIC, &ts);
      uint64_t point = 1;
      if (drmSyncobjTimelineWait(fd, &syncobj, &point, 1,
                                 ts.tv_sec * 1000000000 + ts.tv_nsec + 5000000000, // 5s
                                 DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE, NULL)) {
          printf("drmSyncobjTimelineWait failed %d\n", errno);
      }
  }

Fixes: 01d6c35783 ("drm/syncobj: add support for timeline point wait v8")
Signed-off-by: Erik Kurzinger <ekurzinger@nvidia.com>
Reviewed by: Simon Ser <contact@emersion.fd>
Signed-off-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/1fac96f1-2f3f-f9f9-4eb0-340f27a8f6c0@nvidia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Anup Patel
3df98bd319 RISC-V: Don't fail in riscv_of_parent_hartid() for disabled HARTs
[ Upstream commit c4676f8dc1e12e68d6511f9ed89707fdad4c962c ]

The riscv_of_processor_hartid() used by riscv_of_parent_hartid() fails
for HARTs disabled in the DT. This results in the following warning
thrown by the RISC-V INTC driver for the E-core on SiFive boards:

[    0.000000] riscv-intc: unable to find hart id for /cpus/cpu@0/interrupt-controller

The riscv_of_parent_hartid() is only expected to read the hartid
from the DT so we directly call of_get_cpu_hwid() instead of calling
riscv_of_processor_hartid().

Fixes: ad635e723e ("riscv: cpu: Add 64bit hartid support on RV64")
Signed-off-by: Anup Patel <apatel@ventanamicro.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Link: https://lore.kernel.org/r/20231027154254.355853-2-apatel@ventanamicro.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Florian Westphal
587e6308d6 netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses
[ Upstream commit 80abbe8a8263106fe45a4f293b92b5c74cc9cc8a ]

The ipv6 redirect target was derived from the ipv4 one, i.e. its
identical to a 'dnat' with the first (primary) address assigned to the
network interface.  The code has been moved around to make it usable
from nf_tables too, but its still the same as it was back when this
was added in 2012.

IPv6, however, has different types of addresses, if the 'wrong' address
comes first the redirection does not work.

In Daniels case, the addresses are:
  inet6 ::ffff:192 ...
  inet6 2a01: ...

... so the function attempts to redirect to the mapped address.

Add more checks before the address is deemed correct:
1. If the packets' daddr is scoped, search for a scoped address too
2. skip tentative addresses
3. skip mapped addresses

Use the first address that appears to match our needs.

Reported-by: Daniel Huhardeaux <tech@tootai.net>
Closes: https://lore.kernel.org/netfilter/71be06b8-6aa0-4cf9-9e0b-e2839b01b22f@tootai.net/
Fixes: 115e23ac78 ("netfilter: ip6tables: add REDIRECT target")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Jeremy Sowden
8fa280d1a9 netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs
[ Upstream commit 6f56ad1b92328997e1b1792047099df6f8d7acb5 ]

`nf_nat_redirect_ipv4` takes a `struct nf_nat_ipv4_multi_range_compat`,
but converts it internally to a `struct nf_nat_range2`.  Change the
function to take the latter, factor out the code now shared with
`nf_nat_redirect_ipv6`, move the conversion to the xt_REDIRECT module,
and update the ipv4 range initialization in the nft_redir module.

Replace a bare hex constant for 127.0.0.1 with a macro.

Remove `WARN_ON`.  `nf_nat_setup_info` calls `nf_ct_is_confirmed`:

	/* Can't setup nat info for confirmed ct. */
	if (nf_ct_is_confirmed(ct))
		return NF_ACCEPT;

This means that `ct` cannot be null or the kernel will crash, and
implies that `ctinfo` is `IP_CT_NEW` or `IP_CT_RELATED`.

nft_redir has separate ipv4 and ipv6 call-backs which share much of
their code, and an inet one switch containing a switch that calls one of
the others based on the family of the packet.  Merge the ipv4 and ipv6
ones into the inet one in order to get rid of the duplicate code.

Const-qualify the `priv` pointer since we don't need to write through
it.

Assign `priv->flags` to the range instead of OR-ing it in.

Set the `NF_NAT_RANGE_PROTO_SPECIFIED` flag once during init, rather
than on every eval.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 80abbe8a8263 ("netfilter: nat: fix ipv6 nat redirect with mapped and scoped addresses")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Maciej Żenczykowski
d85670128f netfilter: xt_recent: fix (increase) ipv6 literal buffer length
[ Upstream commit 7b308feb4fd2d1c06919445c65c8fbf8e9fd1781 ]

in6_pton() supports 'low-32-bit dot-decimal representation'
(this is useful with DNS64/NAT64 networks for example):

  # echo +aaaa:bbbb:cccc:dddd:eeee:ffff:1.2.3.4 > /proc/self/net/xt_recent/DEFAULT
  # cat /proc/self/net/xt_recent/DEFAULT
  src=aaaa:bbbb:cccc:dddd:eeee:ffff:0102:0304 ttl: 0 last_seen: 9733848829 oldest_pkt: 1 9733848829

but the provided buffer is too short:

  # echo +aaaa:bbbb:cccc:dddd:eeee:ffff:255.255.255.255 > /proc/self/net/xt_recent/DEFAULT
  -bash: echo: write error: Invalid argument

Fixes: 079aa88fe7 ("netfilter: xt_recent: IPv6 support")
Signed-off-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Roman Bacik
7ee2070589 i2c: iproc: handle invalid slave state
[ Upstream commit ba15a14399c262f91ce30c19fcbdc952262dd1be ]

Add the code to handle an invalid state when both bits S_RX_EVENT
(indicating a transaction) and S_START_BUSY (indicating the end
of transaction - transition of START_BUSY from 1 to 0) are set in
the interrupt status register during a slave read.

Signed-off-by: Roman Bacik <roman.bacik@broadcom.com>
Fixes: 1ca1b45160 ("i2c: iproc: handle Master aborted error")
Acked-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Heiner Kallweit
b5974b0c89 r8169: respect userspace disabling IFF_MULTICAST
[ Upstream commit 8999ce4cfc87e61b4143ec2e7b93d8e92e11fa7f ]

So far we ignore the setting of IFF_MULTICAST. Fix this and clear bit
AcceptMulticast if IFF_MULTICAST isn't set.

Note: Based on the implementations I've seen it doesn't seem to be 100% clear
what a driver is supposed to do if IFF_ALLMULTI is set but IFF_MULTICAST
is not. This patch is based on the understanding that IFF_MULTICAST has
precedence.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/4a57ba02-d52d-4369-9f14-3565e6c1f7dc@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Filippo Storniolo
1fecefb092 vsock/virtio: remove socket from connected/bound list on shutdown
[ Upstream commit 3a5cc90a4d1756072619fe511d07621bdef7f120 ]

If the same remote peer, using the same port, tries to connect
to a server on a listening port more than once, the server will
reject the connection, causing a "connection reset by peer"
error on the remote peer. This is due to the presence of a
dangling socket from a previous connection in both the connected
and bound socket lists.
The inconsistency of the above lists only occurs when the remote
peer disconnects and the server remains active.

This bug does not occur when the server socket is closed:
virtio_transport_release() will eventually schedule a call to
virtio_transport_do_close() and the latter will remove the socket
from the bound and connected socket lists and clear the sk_buff.

However, virtio_transport_do_close() will only perform the above
actions if it has been scheduled, and this will not happen
if the server is processing the shutdown message from a remote peer.

To fix this, introduce a call to vsock_remove_sock()
when the server is handling a client disconnect.
This is to remove the socket from the bound and connected socket
lists without clearing the sk_buff.

Fixes: 06a8fc7836 ("VSOCK: Introduce virtio_vsock_common.ko")
Reported-by: Daan De Meyer <daan.j.demeyer@gmail.com>
Tested-by: Daan De Meyer <daan.j.demeyer@gmail.com>
Co-developed-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Luigi Leonardi <luigi.leonardi@outlook.com>
Signed-off-by: Filippo Storniolo <f.storniolo95@gmail.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Bobby Eshleman
baddcc2c71 virtio/vsock: replace virtio_vsock_pkt with sk_buff
[ Upstream commit 71dc9ec9ac7d3eee785cdc986c3daeb821381e20 ]

This commit changes virtio/vsock to use sk_buff instead of
virtio_vsock_pkt. Beyond better conforming to other net code, using
sk_buff allows vsock to use sk_buff-dependent features in the future
(such as sockmap) and improves throughput.

This patch introduces the following performance changes:

Tool: Uperf
Env: Phys Host + L1 Guest
Payload: 64k
Threads: 16
Test Runs: 10
Type: SOCK_STREAM
Before: commit b7bfaa761d760 ("Linux 6.2-rc3")

Before
------
g2h: 16.77Gb/s
h2g: 10.56Gb/s

After
-----
g2h: 21.04Gb/s
h2g: 10.76Gb/s

Signed-off-by: Bobby Eshleman <bobby.eshleman@bytedance.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 3a5cc90a4d17 ("vsock/virtio: remove socket from connected/bound list on shutdown")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Yu Kuai
46c541fa66 blk-core: use pr_warn_ratelimited() in bio_check_ro()
[ Upstream commit 1b0a151c10a6d823f033023b9fdd9af72a89591b ]

If one of the underlying disks of raid or dm is set to read-only, then
each io will generate new log, which will cause message storm. This
environment is indeed problematic, however we can't make sure our
naive custormer won't do this, hence use pr_warn_ratelimited() to
prevent message storm in this case.

Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Fixes: 57e95e4670 ("block: fix and cleanup bio_check_ro")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Link: https://lore.kernel.org/r/20231107111247.2157820-1-yukuai1@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Li Lingfeng
4e9b3ec84d nbd: fix uaf in nbd_open
[ Upstream commit 327462725b0f759f093788dfbcb2f1fd132f956b ]

Commit 4af5f2e030 ("nbd: use blk_mq_alloc_disk and
blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set
disk->private_data as NULL as before. UAF may be triggered in nbd_open()
if someone tries to open nbd device right after nbd_put() since nbd has
been free in nbd_dev_remove().

Fix this by implementing ->free_disk and free private data in it.

Fixes: 4af5f2e030 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk")
Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20231107103435.2074904-1-lilingfeng@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
George Shuklin
b0310063d4 tg3: power down device only on SYSTEM_POWER_OFF
[ Upstream commit 9fc3bc7643341dc5be7d269f3d3dbe441d8d7ac3 ]

Dell R650xs servers hangs on reboot if tg3 driver calls
tg3_power_down.

This happens only if network adapters (BCM5720 for R650xs) were
initialized using SNP (e.g. by booting ipxe.efi).

The actual problem is on Dell side, but this fix allows servers
to come back alive after reboot.

Signed-off-by: George Shuklin <george.shuklin@gmail.com>
Fixes: 2ca1c94ce0 ("tg3: Disable tg3 device on system reboot to avoid triggering AER")
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/20231103115029.83273-1-george.shuklin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
Anuj Gupta
2dbafb0081 nvme: fix error-handling for io_uring nvme-passthrough
[ Upstream commit 1147dd0503564fa0e03489a039f9e0c748a03db4 ]

Driver may return an error before submitting the command to the device.
Ensure that such error is propagated up.

Fixes: 456cba386e ("nvme: wire-up uring-cmd support for io-passthru on char-device.")
Signed-off-by: Anuj Gupta <anuj20.g@samsung.com>
Signed-off-by: Kanchan Joshi <joshi.k@samsung.com>
Reviewed-by: Niklas Cassel <niklas.cassel@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:17 +01:00
D. Wythe
f4277cb562 net/smc: put sk reference if close work was canceled
[ Upstream commit aa96fbd6d78d9770323b21e2c92bd38821be8852 ]

Note that we always hold a reference to sock when attempting
to submit close_work. Therefore, if we have successfully
canceled close_work from pending, we MUST release that reference
to avoid potential leaks.

Fixes: 42bfba9eaa ("net/smc: immediate termination for SMCD link groups")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:16 +01:00
D. Wythe
2d563aa752 net/smc: allow cdc msg send rather than drop it with NULL sndbuf_desc
[ Upstream commit c5bf605ba4f9d6fbbb120595ab95002f4716edcb ]

This patch re-fix the issues mentioned by commit 22a825c541d7
("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()").

Blocking sending message do solve the issues though, but it also
prevents the peer to receive the final message. Besides, in logic,
whether the sndbuf_desc is NULL or not have no impact on the processing
of cdc message sending.

Hence that, this patch allows the cdc message sending but to check the
sndbuf_desc with care in smc_cdc_tx_handler().

Fixes: 22a825c541d7 ("net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:16 +01:00
D. Wythe
9d976cd3e3 net/smc: fix dangling sock under state SMC_APPFINCLOSEWAIT
[ Upstream commit 5211c9729484c923f8d2e06bd29f9322cc42bb8f ]

Considering scenario:

				smc_cdc_rx_handler
__smc_release
				sock_set_flag
smc_close_active()
sock_set_flag

__set_bit(DEAD)			__set_bit(DONE)

Dues to __set_bit is not atomic, the DEAD or DONE might be lost.
if the DEAD flag lost, the state SMC_CLOSED  will be never be reached
in smc_close_passive_work:

if (sock_flag(sk, SOCK_DEAD) &&
	smc_close_sent_any_close(conn)) {
	sk->sk_state = SMC_CLOSED;
} else {
	/* just shutdown, but not yet closed locally */
	sk->sk_state = SMC_APPFINCLOSEWAIT;
}

Replace sock_set_flags or __set_bit to set_bit will fix this problem.
Since set_bit is atomic.

Fixes: b38d732477 ("smc: socket closing and linkgroup cleanup")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:16 +01:00
Geetha sowjanya
4a12fb7d1a octeontx2-pf: Free pending and dropped SQEs
[ Upstream commit 3423ca23e08bf285a324237abe88e7e7d9becfe6 ]

On interface down, the pending SQEs in the NIX get dropped
or drained out during SMQ flush. But skb's pointed by these
SQEs never get free or updated to the stack as respective CQE
never get added.
This patch fixes the issue by freeing all valid skb's in SQ SG list.

Fixes: b1bc8457e9 ("octeontx2-pf: Cleanup all receive buffers in SG descriptor")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:16 +01:00
Subbaraya Sundeep
a1e8e68204 octeontx2-pf: qos send queues management
[ Upstream commit ab6dddd2a669a0ecc2ce07485c7a15fadbb5a0aa ]

Current implementation is such that the number of Send queues (SQs)
are decided on the device probe which is equal to the number of online
cpus. These SQs are allocated and deallocated in interface open and c
lose calls respectively.

This patch defines new APIs for initializing and deinitializing Send
queues dynamically and allocates more number of transmit queues for
QOS feature.

Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
Signed-off-by: Sunil Kovvuri Goutham <sgoutham@marvell.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 3423ca23e08b ("octeontx2-pf: Free pending and dropped SQEs")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:16 +01:00
Hariprasad Kelam
479d344a92 octeontx2-pf: Rename tot_tx_queues to non_qos_queues
[ Upstream commit 508c58f76ca510956625c945f9b8eb104f2c8208 ]

current implementation is such that tot_tx_queues contains both
xdp queues and normal tx queues. which will be allocated in interface
open calls and deallocated on interface down calls respectively.

With addition of QOS, where send quees are allocated/deallacated upon
user request Qos send queues won't be part of tot_tx_queues. So this
patch renames tot_tx_queues to non_qos_queues.

Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 3423ca23e08b ("octeontx2-pf: Free pending and dropped SQEs")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:16 +01:00
Hangbin Liu
f9c2807e2a selftests: pmtu.sh: fix result checking
[ Upstream commit 63e201916b27260218e528a2f8758be47f99bbf4 ]

In the PMTU test, when all previous tests are skipped and the new test
passes, the exit code is set to 0. However, the current check mistakenly
treats this as an assignment, causing the check to pass every time.

Consequently, regardless of how many tests have failed, if the latest test
passes, the PMTU test will report a pass.

Fixes: 2a9d3716b8 ("selftests: pmtu.sh: improve the test result processing")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 11:52:16 +01:00